Question

I’m using openvpn, a PAM aware app. It has the following useful documentation:

For example:

  plugin openvpn-auth-pam.so "login login USERNAME password PASSWORD"

tells auth-pam to (a) use the "login" PAM module, (b) answer a
"login" query with the username given by the OpenVPN client, and
(c) answer a "password" query with the password given by the
OpenVPN client.  This provides flexibility in dealing with the different
types of query strings which different PAM modules might generate.
For example, suppose you were using a PAM module called
"test" which queried for "name" rather than "login":

Now I want to create an openvpn configuration in /etc/pam.d that gets the username/password from openvpn PAM plugin and passes it to a script. Enter:

pam_exec.so

Setting up a PAM openvpn configuration with an:

auth required pam_exec.so myscript

And configuring openvpn to call:

plugin openvpn-auth-pam.so "openvpn login USERNAME password PASSWORD"

All seems straight forward. The part that gets me is what syntax I use to get the login/password that were defined in openvpn out to the script. The documentation of pam_exec.so seems to ignore this key question.

E.g.:

auth required pam_exec.so myscript %login %password

The above is just my psudo code for how it might look, what should this syntax correctly look like?

Answer 1

The full answer is posted here:

https://forums.openvpn.net/viewtopic.php?t=8310

Without duplicating that answer in full, the jist of it is that the configuration in server.config of openvpn needs to be:

plugin /usr/local/openvpn/sbin/openvpn-auth-pam.so "openvpn"

Contrary to the example provided in the documentation:

plugin openvpn-auth-pam.so "login login USERNAME password PASSWORD"